CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Q: Which deployments are exposed to this timing attack?

Deployments using Catalyst::Plugin::Authentication before 0.10029 are affected when they use the legacy verifier through the deprecated login method. The realm-based verifier is not the affected path described here.

Q: What does an attacker need to exploit the issue?

An attacker needs the ability to make remote authentication attempts and measure response-time differences. The legacy verifier's eq comparisons reveal how many leading bytes of a submitted value match the stored clear-text password, crypt hash, or base64 digest.

Q: What should be done if an immediate upgrade is not possible?

Move authentication away from the deprecated login method and legacy verifier to the realm-based verifier, which is identified as having the earlier issue fixed. Upgrade to version 0.10029 or later when possible.

Published Nov 3, 2026

Updated

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.

CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.

A remote attacker can use response-time differences to guess the stored password or hash.

Affected Software

11 affected components

debian/libcatalyst-plugin-authentication-perl*

debian/libcatalyst-plugin-authentication-perl<=0.10023-4, <=0.10024-1, <=0.10028-1

ubuntu/libcatalyst-plugin-authentication-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Catalyst::Plugin::Authentication to a version that resolves this vulnerability.
Fixed in 0.10029

Event History

Nov 3, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Data Sourced

via OSV·07:51 AM

Weakness

Data Sourced

via NVD·08:17 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this timing attack?

Deployments using Catalyst::Plugin::Authentication before 0.10029 are affected when they use the legacy verifier through the deprecated login method. The realm-based verifier is not the affected path described here.

What does an attacker need to exploit the issue?

An attacker needs the ability to make remote authentication attempts and measure response-time differences. The legacy verifier's eq comparisons reveal how many leading bytes of a submitted value match the stored clear-text password, crypt hash, or base64 digest.

What should be done if an immediate upgrade is not possible?

Move authentication away from the deprecated login method and legacy verifier to the realm-based verifier, which is identified as having the earlier issue fixed. Upgrade to version 0.10029 or later when possible.

CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this timing attack?

What does an attacker need to exploit the issue?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this timing attack?

What does an attacker need to exploit the issue?

What should be done if an immediate upgrade is not possible?